I agree with Rich4092- your ISP should be able to provide you with more detailed information as to what computer is causing the issue.

When this happened to us we updated our firewall to block all outgoing SMTP traffic and used the firewall to tell us what local computer was hitting that block rule. We've kept it this way and it has prevented our email server IP from being blacklisted again when we had a similar issue.

Had similiar issue not to long ago and go blacklisted. Someone should be complaining there PC/Laptop is slow - first possible clue. You should have received an email stating why you were blacklisted - within there, is the address of the computer sending out spam email - if not, your ISP should be able to capture one of these spam emails and send back to you.

I agree with Rich4092- your ISP should be able to provide you with more detailed information as to what computer is causing the issue.

When this happened to us we updated our firewall to block all outgoing SMTP traffic and used the firewall to tell us what local computer was hitting that block rule. We've kept it this way and it has prevented our email server IP from being blacklisted again when we had a similar issue.

We had the same problem at two of our networks. At one of them, a look at the Event logs showed that a password had been compromised. You can watch the event log in Security and see the bot trying different passwords on common user names. In this case, the bot accidentally got it. That user name was being used to send the email. I disabled the user, and the spam stopped. A look at the Exchange console showed thousands of outgoing spam. That will also show you where it's coming from. Then I go to mxtoolbox.com. You can verify you're not an open relay and check what blacklists you've inadvertently joined. That list gives you links so you can remove your domain from all of them.

What I learned is that it's something as simple as a compromised password, antivirus won't even know it's happening.